contrib/macdeploy/detached-sig-create.sh reads two passphrases and passes them to signapple with --passphrase. Every sign call gets the code signing key passphrase. Every notarize call gets the App Store Connect key passphrase. While a call runs, its passphrase is in the process arguments, which ps shows. contrib/windeploy/detached-sig-create.sh passes its key passphrase to osslsigncode sign with -pass. Both came in with #31407.
On Windows, the script could pipe the passphrase to osslsigncode sign -readpass -, which reads it from stdin. osslsigncode 2.14, the version Guix pins, has -readpass. On macOS, signapple takes the passphrase only from --passphrase or from a prompt (3fab3bb, its master and the Guix pin). Without --passphrase it would prompt once per call. So signapple would first need an option that reads the passphrase from a file descriptor, a file or the environment.
I ran the macOS script with a stub signapple that prints its own ps line, and each passphrase appeared there. I did not run either script with the real tools or keys. Would the codesigners take a change along these lines?
I found this during a large audit of Bitcoin Core that I did with the help of LLM tools. I understand the scripts and will answer questions myself.